Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Adding plus/minus one hour to time tokens

$
0
0
Hi folks, I'm running the transaction command, in a drilldown panel that passes the times picked on the timechart down to the next panel as tokens. The problem I run into is where the transactions don't fall within the hour slice, I want the token to subtract and hour from the earliest time, and add an hour to the latest, so I can encompass the transaction. I tried $earliest_time$ - 1h Splunk says "Invalid earliest_time" Is there a way to offset the tokens this way?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>